3 ms·
The reason for outrage is that this problem is so glaringly obvious that we can't dismiss it as an oversight, especially with a company as advanced as Apple cla
by totalZero 6y ago
The reason for outrage is that this problem is so glaringly obvious that we can't dismiss it as an oversight, especially with a company as advanced as Apple claims to be. They boast about the T2 chip and all of their security measures. So for them to leave the gate unlocked on something like this is problematic. It means they made the choice to expose and log users' activity, to some degree or another, on purpose.
To further protect privacy, we have stopped logging IP addresses associated with Developer ID certificate checks, and we will ensure that any collected IP addresses are removed from logs.
Why would they ever have logged IP addresses, if the goal is simply to verify the user-side authenticity of an app?
- evercast 6y agoIt may be worth noting that we do not really know what do they mean by "logs". These can be either database records or simply text logs generated by a web server sitting in front of the OCSP backend and logging the requests, regardless of what those requests are referring to. In other words, it does not have to be a conscious decision to "harvest IP addresses" but could easily be a side-effect of what the infrastructure does. Still, it is no excuse for them as one would expect clear and thorough security/privacy audits before rolling out such features. Especially from companies like Apple.